126 if ((
Cookie & 0xF0000000) ||
129 DPRINT1(
"LdrUnlockLoaderLock() called with an invalid cookie!\n");
325 RtlInitEmptyUnicodeString(&DllString2,
NULL, 0);
342 RedirectedDll =
TRUE;
365 DPRINT1(
"[%p, %p] LDR: Recursive DLL Load\n",
368 DPRINT1(
"[%p, %p] Previous DLL being loaded \"%wZ\"\n",
372 DPRINT1(
"[%p, %p] DLL being requested \"%wZ\"\n",
380 DPRINT1(
"[%p, %p] LDR: No DLL Initializer was running\n",
386 DPRINT1(
"[%p, %p] DLL whose initializer was currently running \"%wZ\"\n",
415 "LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x\n",
482 NextEntry = ListHead->
Flink;
483 while (NextEntry != ListHead)
504 NextEntry = NextEntry->
Flink;
511 "LDR: %s() exiting 0x%08lx\n",
538 RtlInitEmptyUnicodeString(&DllString1,
NULL, 0);
539 RtlInitEmptyUnicodeString(&RawDllName,
NULL, 0);
540 RedirectName = *DllName;
541 pRedirectName = &RedirectName;
549 if (DllHandle) *DllHandle =
NULL;
555 DPRINT1(
"Flags are invalid or no DllHandle given\n");
586 RedirectedDll =
TRUE;
595 ASSERT(pRedirectName == &RedirectName);
644 p1 = pRedirectName->
Buffer;
653 else if (*p1 ==
L'\\')
660 if (!(p2) || (*p2 ==
L'\\') || (*p2 ==
L'/'))
720 DPRINT1(
"LDR: LdrGetDllHandleEx, searching for %wZ from %ws\n",
775 if (DllHandle) *DllHandle = LdrEntry->
DllBase;
854 DPRINT(
"LdrVerifyImageMatchesChecksum() called\n");
869 DPRINT1 (
"NtCreateSection() failed (Status 0x%x)\n",
Status);
888 DPRINT1(
"NtMapViewOfSection() failed (Status 0x%x)\n",
Status);
901 DPRINT1(
"NtMapViewOfSection() failed (Status 0x%x)\n",
Status);
931 if (ImageCharacteristics)
947 while (ImportData->
Name)
994 DPRINT(
"LdrQueryProcessModuleInformation() called\n");
1002 if (
Size < UsedSize)
1008 ModuleInformation->NumberOfModules = 0;
1009 ModulePtr = &ModuleInformation->Modules[0];
1026 if (UsedSize >
Size)
1041 InitListHead = &
NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
1042 InitEntry = InitListHead->
Flink;
1044 while (InitEntry != InitListHead)
1052 if (InitModule == Module)
break;
1055 InitEntry = InitEntry->
Flink;
1077 if (ModuleInformation)
1078 ModuleInformation->NumberOfModules++;
1097 DPRINT(
"LdrQueryProcessModuleInformation() done\n");
1138 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1139 ListEntry = ListHead->
Flink;
1140 while (ListHead != ListEntry)
1171 ListEntry = ListEntry->
Flink;
1330 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
1332 ULONG ComSectionSize;
1394 InInitializationOrderLinks);
1395 NextEntry = NextEntry->
Blink;
1398 LdrEntry->
Flags &= ~LDRP_UNLOAD_IN_PROGRESS;
1406 DPRINT1(
"(%lu) [%ws] %ws (%lx) deinit %p\n",
1422 CurrentEntry = LdrEntry;
1445 CurrentEntry =
NULL;
1455 CurrentEntry = LdrEntry;
1472 DPRINT1(
"LDR: Calling deinit %p\n", EntryPoint);
1494 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1505 CurrentEntry =
NULL;
1510 NextEntry = UnloadList.
Flink;
1511 while (NextEntry != &UnloadList)
1515 NextEntry = NextEntry->
Flink;
1516 CurrentEntry = LdrEntry;
1538 DPRINT1(
".NET Images are not supported yet\n");
1560 DPRINT1(
"We don't support Hotpatching yet\n");
1607#define STATUS_MUI_FILE_NOT_FOUND ((NTSTATUS)0xC00B0001L)
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
NTSTATUS NTAPI NtMapViewOfSection(IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
BOOL CALLBACK EnumProc(_In_ HWND hwnd, _In_ LPARAM lParam)
#define DECLSPEC_HOTPATCH
static BOOL CompareName(LPCWSTR pszName1, LPCWSTR pszName2)
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES IN DWORD Unknown3
#define NT_SUCCESS(StatCode)
NTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG Flags, IN PUNICODE_STRING OriginalName, IN PUNICODE_STRING Extension, IN OUT PUNICODE_STRING StaticString, IN OUT PUNICODE_STRING DynamicString, IN OUT PUNICODE_STRING *NewName, IN PULONG NewFlags, IN PSIZE_T FileNameSize, IN PSIZE_T RequiredLength)
#define DLL_PROCESS_DETACH
#define RtlImageDirectoryEntryToData
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define InitializeListHead(ListHead)
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
#define EXCEPTION_EXECUTE_HANDLER
#define FLG_HEAP_ENABLE_TAIL_CHECK
NTSYSAPI BOOLEAN WINAPI RtlDllShutdownInProgress(void)
long __cdecl _InterlockedIncrement(_Interlocked_operand_ long volatile *_Addend)
LIST_ENTRY * ModuleListHead
NTSTATUS NTAPI LdrGetDllHandleEx(IN ULONG Flags, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle OPTIONAL)
LONG LdrpLoaderLockAcquisitionCount
NTSTATUS NTAPI LdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
NTSTATUS NTAPI LdrLoadAlternateResourceModule(IN PVOID Module, IN PWSTR Buffer)
NTSTATUS NTAPI LdrAccessOutOfProcessResource(IN PVOID Unknown, IN PVOID Image, IN PVOID Unknown1, IN PVOID Unknown2, IN PVOID Unknown3)
NTSTATUS NTAPI LdrUnloadDll(IN PVOID BaseAddress)
NTSTATUS NTAPI LdrLockLoaderLock(IN ULONG Flags, OUT PULONG Disposition OPTIONAL, OUT PULONG_PTR Cookie OPTIONAL)
NTSTATUS NTAPI LdrFindCreateProcessManifest(IN ULONG Flags, IN PVOID Image, IN PVOID IdPath, IN ULONG IdPathLength, IN PVOID OutDataEntry)
NTSTATUS NTAPI LdrQueryProcessModuleInformationEx(IN ULONG ProcessId, IN ULONG Reserved, OUT PRTL_PROCESS_MODULES ModuleInformation, IN ULONG Size, OUT PULONG ReturnedSize OPTIONAL)
NTSTATUS NTAPI LdrQueryProcessModuleInformation(IN PRTL_PROCESS_MODULES ModuleInformation, IN ULONG Size, OUT PULONG ReturnedSize OPTIONAL)
#define STATUS_MUI_FILE_NOT_FOUND
UNICODE_STRING LdrApiDefaultExtension
NTSTATUS NTAPI LdrGetDllHandle(IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
VOID NTAPI LdrSetDllManifestProber(_In_ PLDR_MANIFEST_PROBER_ROUTINE Routine)
NTSTATUS NTAPI LdrFindEntryForAddress(PVOID Address, PLDR_DATA_TABLE_ENTRY *Module)
BOOLEAN NTAPI LdrInitShimEngineDynamic(IN PVOID BaseAddress)
PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine
BOOLEAN LdrpBreakOnRecursiveDllLoads
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(IN PWSTR SearchPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress)
LIST_ENTRY LdrpUnloadHead
NTSTATUS NTAPI LdrVerifyImageMatchesChecksum(IN HANDLE FileHandle, IN PLDR_CALLBACK Callback, IN PVOID CallbackContext, OUT PUSHORT ImageCharacteristics)
NTSTATUS NTAPI LdrCreateOutOfProcessImage(IN ULONG Flags, IN HANDLE ProcessHandle, IN HANDLE DllHandle, IN PVOID Unknown3)
NTSTATUS NTAPI LdrUnlockLoaderLock(IN ULONG Flags, IN ULONG Cookie OPTIONAL)
BOOLEAN NTAPI LdrFlushAlternateResourceModules(VOID)
NTSTATUS NTAPI LdrDestroyOutOfProcessImage(IN PVOID Image)
BOOLEAN LdrpShowRecursiveLoads
ULONG AlternateResourceModuleCount
NTSTATUS NTAPI LdrEnumerateLoadedModules(IN BOOLEAN ReservedFlag, IN PLDR_ENUM_CALLBACK EnumProc, IN PVOID Context)
NTSTATUS NTAPI LdrAddRefDll(IN ULONG Flags, IN PVOID BaseAddress)
NTSTATUS NTAPI LdrDisableThreadCalloutsForDll(IN PVOID BaseAddress)
FORCEINLINE ULONG_PTR LdrpMakeCookie(VOID)
BOOLEAN NTAPI LdrUnloadAlternateResourceModule(IN PVOID BaseAddress)
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock(IN ULONG_PTR Address, IN ULONG Count, IN PUSHORT TypeOffset, IN LONG_PTR Delta)
BOOLEAN NTAPI LdrAlternateResourcesEnabled(VOID)
NTSTATUS NTAPI LdrSetAppCompatDllRedirectionCallback(_In_ ULONG Flags, _In_ PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION CallbackFunction, _In_opt_ PVOID CallbackData)
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlockLongLong(_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONGLONG Delta)
BOOLEAN NTAPI LdrVerifyMappedImageMatchesChecksum(_In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytes, _In_ ULONG FileLength)
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT
_In_ PVOID _Out_ BOOLEAN * Stop
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
#define LDR_ADDREF_DLL_PIN
#define LDR_COR_OWNS_UNMAP
#define LDR_GET_DLL_HANDLE_EX_PIN
_In_ PCWSTR _Out_ PVOID * ActCtx
#define LDRP_DONT_CALL_FOR_THREADS
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED
LDR_MANIFEST_PROBER_ROUTINE * PLDR_MANIFEST_PROBER_ROUTINE
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
#define LDRP_PROCESS_ATTACH_CALLED
LDR_ENUM_CALLBACK * PLDR_ENUM_CALLBACK
VOID NTAPI LdrpGetShimEngineInterface()
static const char const char * DllPath
static OUT PIO_STATUS_BLOCK IoStatusBlock
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
#define DPFLTR_WARNING_LEVEL
_In_ HANDLE ProcessHandle
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
NTSYSAPI BOOLEAN NTAPI RtlTryEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI ULONG __cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ _Printf_format_string_ PCSTR Format,...)
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
_In_ PMEMORY_AREA _In_ PVOID _In_ BOOLEAN Locked
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
#define SECTION_MAP_EXECUTE
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
#define NtCurrentProcess()
NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(IN HANDLE hFile, OUT PIO_STATUS_BLOCK pIoStatusBlock, OUT PVOID FileInformationBuffer, IN ULONG FileInformationBufferLength, IN FILE_INFORMATION_CLASS FileInfoClass)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
#define UNICODE_STRING_MAX_BYTES
_In_ ULONG _In_ ULONG _In_ ULONG Length
BOOLEAN LdrpShutdownInProgress
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
PVOID g_pShimEngineModule
VOID NTAPI LdrpUpdateLoadCount2(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags)
#define LDRP_UPDATE_DEREFCOUNT
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
ULONG LdrpActiveUnloadCount
VOID NTAPI LdrpFinalizeAndDeallocateDataTableEntry(IN PLDR_DATA_TABLE_ENTRY Entry)
NTSTATUS(NTAPI * PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION)(_In_ ULONG Flags, _In_ PCWSTR DllName, _In_ PCWSTR DllPath OPTIONAL, _Inout_opt_ PULONG DllCharacteristics, _In_ PVOID CallbackData, _Outptr_ PWSTR *EffectiveDllPath)
PLDR_DATA_TABLE_ENTRY LdrpGetModuleHandleCache
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrpGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress, IN BOOLEAN ExecuteInit)
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
VOID NTAPI AVrfDllUnloadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
RTL_CRITICAL_SECTION LdrpLoaderLock
#define LDRP_UPDATE_REFCOUNT
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
ULONG NTAPI LdrpClearLoadInProgress(VOID)
PVOID g_pfnSE_DllUnloaded
PLDR_DATA_TABLE_ENTRY LdrpLoadedDllHandleCache
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
#define STATUS_INTERNAL_ERROR
#define STATUS_IMAGE_CHECKSUM_MISMATCH
#define STATUS_DLL_NOT_FOUND
#define STATUS_INVALID_PARAMETER_2
#define STATUS_NO_MORE_ENTRIES
#define STATUS_DLL_INIT_FAILED
#define STATUS_NOT_IMPLEMENTED
#define STATUS_INVALID_PARAMETER_1
#define STATUS_SXS_KEY_NOT_FOUND
#define STATUS_INVALID_PARAMETER_3
#define STATUS_NAME_TOO_LONG
#define IMAGE_DIRECTORY_ENTRY_IMPORT
#define FileStandardInformation
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
_Check_return_ _CRTIMP _CONST_RETURN char *__cdecl strrchr(_In_z_ const char *_Str, _In_ int _Ch)
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlActivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, IN PVOID Context)
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlDeactivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame)
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
PULONG MinorVersion OPTIONAL
base of all file and directory entries
PACTIVATION_CONTEXT EntryPointActivationContext
UNICODE_STRING FullDllName
LIST_ENTRY InLoadOrderLinks
LIST_ENTRY InInitializationOrderLinks
LIST_ENTRY InMemoryOrderLinks
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Blink
struct _LIST_ENTRY * Flink
LIST_ENTRY InInitializationOrderModuleList
LIST_ENTRY InMemoryOrderModuleList
#define RTL_CONSTANT_STRING(s)
#define RtlZeroMemory(Destination, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_INVALID_PARAMETER
#define STATUS_NO_SUCH_FILE
#define STATUS_INFO_LENGTH_MISMATCH
#define STATUS_OBJECT_NAME_NOT_FOUND
VOID(NTAPI * PLDR_CALLBACK)(PVOID CallbackContext, PCHAR Name)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
_Reserved_ PVOID Reserved
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR _In_ ULONGLONG _In_ ULONGLONG _In_opt_ PEVENT_FILTER_DESCRIPTOR _Inout_opt_ PVOID CallbackContext
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
_In_ PCALLBACK_FUNCTION CallbackFunction